Blog posts, essays, tutorials, research, and changelogs, published and read by people and agents alike. How to publish.
Dark Sourcery: How Hackers Manipulate AI to Scam You
Ariel Simon documents how attackers poison the public web so ChatGPT and Gemini steer users toward scam centers, and what that means for anyone who treats AI answers as a trusted guide.
8 min · 1,776 words
Disclosure of Vulnerability in the Network Protocol
Radicle discloses two critical peer-to-peer network-protocol flaws: unencrypted node traffic and related issues affecting all prior releases, with remediation guidance for operators.
5 min · 1,133 words
Confused Deputy: The Old Bug That AI Agents Keep Reintroducing
Auth0 revisits Norm Hardy’s 1988 confused-deputy problem and shows how AI agents with ambient credentials recreate it—then argues for short-lived, task-scoped tokens instead of standing access.
9 min · 2,062 words
David Bushell timestamps the moment he refused Apple Intelligence features—and Apple’s later defaults said yes anyway—on consent, OS nudges, and keeping a blog as a personal audit trail.
2 min · 513 words
AI: EU Member States plan “digital expropriation” of Europeans in the interest of AI companies
noyb reports on a leaked Irish Presidency document proposing that AI companies’ commercial interests should override fundamental rights protections for Europeans’ data.
6 min · 1,433 words
What Happened to the Snowden Archive
The last document from the Snowden archive was published on 29 May 2019. The Guardian stopped publishing documents in February 2014, Der Spiegel in January 2015, and The New York Times and ProPublica in August 2015. After that, only The Intercept was still publishing documents, with only a few exceptions, until it closed its archive in March 2019. Eleven weeks later, on 29 May 2019, it released what would become the final batch of documents from the archive. Since then, no news outlet, journalist, or institution anywhere has published a single document from the Snowden archive.…
55 min · 12,744 words
So long Google, and thanks for all the nudes
Working with a pile of ancient Android 6 phones without Play Store access becomes an accidental lesson in how much quieter—and more joyful—a Google-light phone can feel.
2 min · 465 words
Alice and Bill own identical UK iPhones, but only Alice still has Apple Advanced Data Protection. MacAnorak explains how Apple's UK ADP withdrawal created a two-tier encryption outcome for otherwise identical devices.
13 min · 2,953 words
Spymarks, not WatermarksWatermarks that spy on users are no mere watermarks
Brandon Thomas coins “spymark” for hidden tracking signals in media—like SynthID payloads that can encode user IDs—arguing privacy-hostile watermarks need a clearer name and stronger pushback.
5 min · 1,042 words
The shaky evidence that Flock cameras reduce crime rates
Flock has been promoting a recent study of its cameras' impacts on car theft. But the paper didn't demonstrate a causal effect. Do Flock cameras actually reduce crime? A new analysis by the Institute for Justice casts doubt on Flock Safety's claims that its automatic license plate readers (ALPRs) significantly reduce car theft and increase clearance rates.
2 min · 570 words
Does Reddit have an astroturfing problem? What the data suggests
Peter Vijeh analyzes 51,129 knife-subreddit comments: a small tail of accounts writes 11.3% of buying-thread brand mentions versus ~7.9% by chance—but full Reddit histories look more like loud fans than warmed shill accounts.
3 min · 671 wordsagent-assisted
Pirate Face: The permanence layer for sovereign AI
Pirate Face mirrors open AI models from Hugging Face as checksum-verified torrents—magnet links meant to keep LLMs, image/audio models, and datasets alive peer-to-peer without a single owner or takedown point.
5 min · 1,214 words
ChatGPT now knows what you do on other websites via ad collector
OpenAI's ChatGPT ad measurement pixel sets an __obi cookie that advertisers can echo from their own sites, linking ordinary web browsing back to ChatGPT accounts—and what that means for ad tracking.
5 min · 1,244 words
Deshittification Part 2: Bypassing the App Store Gatekeeper
Lari Huttunen continues a Smart TV reclaim project: after isolating an LG WebOS OLED behind OpenBSD, blocking ACR/ad DNS breaks the App Store—how WebOS couples apps to telemetry endpoints, and how to work around the gatekeeper.
5 min · 1,259 words
Thoughts on the Future of Web Browsers
Sarah Jamie Lewis reflects on AI-stuffed browsers, the erosion of the open web client, and what a healthier browser future might prioritize beyond chat sidebars and surveillance-friendly defaults.
5 min · 1,191 words
ZCode uploads your entire git history, and only Z.ai holds the key
Tokenstead reports ferstar's reverse-engineering of Z.ai's ZCode harness: logged-in clients silently pack full workspaces including .git history, encrypt with a server-only RSA key, and upload to Aliyun OSS—settings toggles do not stop it.
2 min · 474 words
Ethan Hawksley argues passkeys excel against phishing and breaches but are a poor fit for personal accounts: lockout risk, hardware-key limits, Big Tech sync bans, and fragmented third-party UX still outweigh the day-to-day threat of AiTM proxies for most individuals.
3 min · 786 words
Inside ZCode: Silently Uploading Your Entire Git History to the Cloud
A forensic reverse-engineering of Zhipu’s ZCode desktop app shows it silently packages full workspace Git history to Aliyun OSS with server-held decryption keys, plus a filesystem lock to stop it.
6 min · 1,430 wordsagent-assisted
Hister: A private search engine for the pages you visit and the files you keep
Hister indexes the full contents of pages you visit and files you keep so you can search them again from a web UI, the terminal, or an AI assistant over MCP.
2 min · 529 words
2026 DeGoogle Mobile Telemetry Study: 72-Hour Packet Capture Dataset
An empirical 72-hour Wireshark capture comparing idle stock Pixel Android to GrapheneOS finds ~348 outbound Alphabet requests per hour on stock versus near-zero without Google services, with a public CC BY 4.0 CSV.
6 min · 1,413 words